Søg
Avatar billede lamaduck Nybegynder
12. oktober 2005 - 19:54 Der er 12 kommentarer og
1 løsning

Hijacl this, noget der skal væk?

vil lige hjælpe min mor og søster med denne computer (gør den ren) håber der er en der vil kikke denne log igennem

Logfile of HijackThis v1.99.1
Scan saved at 18:59:08, on 12-10-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\crpw32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Launch Manager\Wbutton.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\PRISMSTA.EXE
C:\Programmer\Launch Manager\OSD.exe
C:\Programmer\Launch Manager\LaunchAp.exe
C:\Programmer\Launch Manager\HotkeyApp.exe
C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
D:\Programmer\D-Tools\daemon.exe
C:\Programmer\Daily Weather Forecast\weather.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\apinf.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Sabine\Skrivebord\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {2D201E84-42AB-E4FA-7FB1-294F80D83F1B} - C:\WINDOWS\system32\adddt32.dll
O2 - BHO: Class - {3A5153EA-63AF-772D-4B56-4C560E2D983E} - C:\WINDOWS\system32\sdkdr32.dll
O2 - BHO: Class - {7A30E1DF-0A72-AEB7-7E44-79412564B4A7} - C:\WINDOWS\winvq.dll
O2 - BHO: Class - {8BB4CD35-4317-18A3-AE58-1B39B48E91E8} - C:\WINDOWS\sdkay32.dll
O2 - BHO: Class - {8D581B79-7AD1-2537-0E66-F037063DC7BF} - C:\WINDOWS\ntzm32.dll
O2 - BHO: Class - {97AB2DB6-2797-5E66-F69B-1C10B62342C2} - C:\WINDOWS\mfcyn32.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: Class - {F853A78A-343F-AC2C-6EC1-7AD1A007D9CD} - C:\WINDOWS\system32\sysiz.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CtrlVol] C:\Programmer\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Programmer\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [OSD] C:\Programmer\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Programmer\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Programmer\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Programmer\Daily Weather Forecast\weather.exe
O4 - HKLM\..\Run: [appet32.exe] C:\WINDOWS\system32\appet32.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [crpq.exe] C:\WINDOWS\crpq.exe
O4 - HKLM\..\Run: [neten.exe] C:\WINDOWS\neten.exe
O4 - HKLM\..\Run: [apixq.exe] C:\WINDOWS\system32\apixq.exe
O4 - HKLM\..\Run: [d3ng.exe] C:\WINDOWS\system32\d3ng.exe
O4 - HKLM\..\Run: [apinf.exe] C:\WINDOWS\apinf.exe
O4 - HKLM\..\Run: [msqd.exe] C:\WINDOWS\system32\msqd.exe
O4 - HKLM\..\Run: [winwn.exe] C:\WINDOWS\system32\winwn.exe
O4 - HKLM\..\RunOnce: [crpw32.exe] C:\WINDOWS\crpw32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by24fd.bay24.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111407587203
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crpw32.exe"  /s (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Avatar billede kalp Novice
12. oktober 2005 - 20:30 #1
ser på det
Avatar billede kalp Novice
12. oktober 2005 - 20:30 #2
og ja der er masser:p
Avatar billede kalp Novice
12. oktober 2005 - 20:39 #3
Download og gem denne scanner på skrivebordet. (Vi skal bruge den senere)
http://www.spywareinfo.dk/download/mwav.exe

Download Ewido (Trial version) (Installer og opdater programmet, men vent med,  at scanne til jeg siger til)
http://shop.element5.com/product.html?productid=531168

Højreklik på windows start knappen (helt nede i venstre hjørne af din skærm) og vælge "Stifinder", klik på Funktioner->Mappeindstillinger->Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Genstart i Fejlsikret tilstand ved at taste F8 under opstart.

Scan med Ewido nu!

Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer. Dobbelt tjeck alt kom med!. Klik herefter "Fix checked" i hijackthis:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\luocv.dll/sp.html#17702
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {2D201E84-42AB-E4FA-7FB1-294F80D83F1B} - C:\WINDOWS\system32\adddt32.dll
O2 - BHO: Class - {3A5153EA-63AF-772D-4B56-4C560E2D983E} - C:\WINDOWS\system32\sdkdr32.dll
O2 - BHO: Class - {7A30E1DF-0A72-AEB7-7E44-79412564B4A7} - C:\WINDOWS\winvq.dll
O2 - BHO: Class - {8BB4CD35-4317-18A3-AE58-1B39B48E91E8} - C:\WINDOWS\sdkay32.dll
O2 - BHO: Class - {8D581B79-7AD1-2537-0E66-F037063DC7BF} - C:\WINDOWS\ntzm32.dll
O2 - BHO: Class - {97AB2DB6-2797-5E66-F69B-1C10B62342C2} - C:\WINDOWS\mfcyn32.dll
O2 - BHO: Class - {F853A78A-343F-AC2C-6EC1-7AD1A007D9CD} - C:\WINDOWS\system32\sysiz.dll
O4 - HKLM\..\Run: [appet32.exe] C:\WINDOWS\system32\appet32.exe
O4 - HKLM\..\Run: [crpq.exe] C:\WINDOWS\crpq.exe
O4 - HKLM\..\Run: [crpq.exe] C:\WINDOWS\crpq.exe
O4 - HKLM\..\Run: [neten.exe] C:\WINDOWS\neten.exe
O4 - HKLM\..\Run: [apixq.exe] C:\WINDOWS\system32\apixq.exe
O4 - HKLM\..\Run: [d3ng.exe] C:\WINDOWS\system32\d3ng.exe
O4 - HKLM\..\Run: [apinf.exe] C:\WINDOWS\apinf.exe
O4 - HKLM\..\Run: [msqd.exe] C:\WINDOWS\system32\msqd.exe
O4 - HKLM\..\Run: [winwn.exe] C:\WINDOWS\system32\winwn.exe
O4 - HKLM\..\RunOnce: [crpw32.exe] C:\WINDOWS\crpw32.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crpw32.exe"  /s (file missing)

Find og slet (Kig godt efter!!.. Det du ikke finder har hijackthis muligvis selv kunne slette!)

Filerne

C:\WINDOWS\crpw32.exe
C:\WINDOWS\apinf.exe
C:\WINDOWS\system32\appet32.exe
C:\WINDOWS\system32\adddt32.dll
C:\WINDOWS\system32\sdkdr32.dll
C:\WINDOWS\winvq.dll
C:\WINDOWS\sdkay32.dll
C:\WINDOWS\ntzm32.dll
C:\WINDOWS\mfcyn32.dll
C:\WINDOWS\system32\sysiz.dll
C:\WINDOWS\system32\appet32.exe
C:\WINDOWS\crpq.exe
C:\WINDOWS\crpq.exe
C:\WINDOWS\neten.exe
C:\WINDOWS\system32\apixq.exe
C:\WINDOWS\system32\d3ng.exe
C:\WINDOWS\apinf.exe
C:\WINDOWS\system32\msqd.exe
C:\WINDOWS\system32\winwn.exe
C:\WINDOWS\crpw32.exe
C:\WINDOWS\crpw32.exe" 

Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Diskoprydning og slet temp-filer, temporary internet files og papirkurv.

Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files

Genstart normalt og kopir en ny hijackthis log herind så jeg kan se om vi fik fjernet det hele eller om noget skulle være blevet overset:)
Avatar billede lamaduck Nybegynder
12. oktober 2005 - 20:42 #4
når det ikke i aften (halv lukkede øjne) men gør det i morgen :) (tak for hjælpen)
Avatar billede lamaduck Nybegynder
13. oktober 2005 - 17:38 #5
håber det hele kommer væk da denne computer (bærbar) skal med på 1 uges ferie så der ikke kommer problemer (har også installer avast)

Logfile of HijackThis v1.99.1
Scan saved at 17:39:55, on 13-10-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Programmer\Avast4\aswUpdSv.exe
d:\Programmer\Avast4\ashServ.exe
d:\Programmer\ewido\security suite\ewidoctrl.exe
d:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\PRISMSTA.EXE
C:\Programmer\Launch Manager\OSD.exe
C:\Programmer\Launch Manager\LaunchAp.exe
C:\Programmer\Launch Manager\HotkeyApp.exe
C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
D:\Programmer\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\PROGRA~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Messenger\msmsgs.exe
d:\Programmer\Avast4\setup\avast.setup
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Sabine\Skrivebord\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CtrlVol] C:\Programmer\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Programmer\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [OSD] C:\Programmer\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Programmer\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Programmer\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crpw32.exe"  /s (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - d:\Programmer\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - d:\Programmer\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Programmer\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Programmer\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - d:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - d:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Avatar billede kalp Novice
13. oktober 2005 - 19:36 #6
den er faktisk ren.. vi skal bare lige have denne væk..

O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\crpw32.exe" /s (file missing)

så fiks den i fejlsikret tilstand..

Klik på Start->Kør skriv services.msc og klik OK.

og deaktiver "Remote Procedure Call (RPC) Helper"

genstart og ny log
Avatar billede lamaduck Nybegynder
13. oktober 2005 - 19:37 #7
lydder godt :) smider en ny log om 5-10 min
Avatar billede lamaduck Nybegynder
13. oktober 2005 - 19:44 #8
Logfile of HijackThis v1.99.1
Scan saved at 19:47:10, on 13-10-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Launch Manager\Wbutton.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\PRISMSTA.EXE
C:\Programmer\Launch Manager\OSD.exe
C:\Programmer\Launch Manager\LaunchAp.exe
C:\Programmer\Launch Manager\HotkeyApp.exe
C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
D:\Programmer\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\PROGRA~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Messenger\msmsgs.exe
d:\Programmer\Avast4\aswUpdSv.exe
d:\Programmer\Avast4\ashServ.exe
d:\Programmer\ewido\security suite\ewidoctrl.exe
d:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
d:\Programmer\Avast4\ashWebSv.exe
d:\Programmer\Avast4\ashMaiSv.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Sabine\Skrivebord\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmer\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CtrlVol] C:\Programmer\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Programmer\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [OSD] C:\Programmer\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Programmer\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Programmer\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmer\Fælles filer\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - d:\Programmer\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - d:\Programmer\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - d:\Programmer\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - d:\Programmer\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - d:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - d:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Avatar billede lamaduck Nybegynder
13. oktober 2005 - 19:45 #9
hvad med den hvor der står (file missing) ?
Avatar billede lamaduck Nybegynder
13. oktober 2005 - 19:48 #10
ikke den med dem :)
Avatar billede kalp Novice
13. oktober 2005 - 20:17 #11
loggen er ren nu... og nej dem skal du ikke fikse.. hijackthis er påvirket tror jeg.. dit antivirus program er ikke missing hehe
Avatar billede lamaduck Nybegynder
13. oktober 2005 - 20:19 #12
Så siger jeg mange tak :D
Avatar billede kalp Novice
13. oktober 2005 - 20:19 #13
selv tak:))
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Se alle it-kurser fra Computerworld Kurser
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.
Se alle it-kurser

Flere spørgsmål fra Andet hardware kategorien

Titel Indlæg Oprettet Seneste aktivitet
DVB T2 tuner med optagefunktion Af ErikHg i Andet hardware 5 22/07/202620:19 29/07/202620:30
overføre internet til gæstehus Af Malm i Andet hardware 16 14/07/202613:08 23/08/202610:08
Et wifi net til en kolonihave uden wifi Af Andershoegh i Andet hardware 12 09/07/202615:37 13/07/202617:24
Sletning af WD Elements - som er krypteret (og ikke kommer normalt frem på skærmen med indtast af kode). Af Rikke i Andet hardware 18 07/07/202611:24 30/07/202616:18
Creative Soundblaster Audigy FX v2 Af ErikHg i Andet hardware 5 28/06/202620:51 29/06/202617:09
Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Opret Log ind

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten
Seneste spørgsmål Seneste aktivitet
23 min siden Installer alarmlyd på Samsung Galaxy XCover 7 Pro Af ErikHg i Mobiltelefoner
08/0913:06 Kan ikke starte min pc Af Malm i PC
07/0919:20 DVD program Af dcedata1977 i Andet software
07/0916:09 Bitdefender brokker sig Af FinnRasmussen i Andet sikkerhed
06/0921:00 Libre Office Impress Af Frank i Andre styresystemer
White papers
Flere white papers »